1. Field of the Invention
The present invention relates to an electronic settlement system in which settlement processing, using a network or the like, can be safely carried out by using a data storage device holding a common key, as well as a settlement management device, a store device, a client device, a data storage device, a computer program, and a storage medium.
2. Description of the Prior Art
In order to safely carry out electronic commercial transactions through an open network such as the Internet, a PKI (Public Key Infrastructure) protocol has been adopted.
In the PKI protocol, a transmission source creates signature information by using a private key, and the transmission source transmits the signature information together with transmission information to a transmission destination. At the transmission destination, by checking the signature information by using a public key corresponding to the private key, it is judged whether or not the received transmission information is created by a proper transmission source.
In recent years, there has been an attempt to carry out electronic commercial transactions through a network by using a data storage device such as an IC (Integrated Circuit) card. Here, in general, the data storage device holds a common key, and carries out input/output of secret information using a common key encryption system. In this sort of data storage device, since the common key cannot become a key for creating signature information, there is merit in that, even in the case where the data storage device is lost, the damage can be made low.
However, in order to safely carry out the electronic commercial transactions through the network, it is necessary to create signature information by using a private key. However, in the conventional method, since the data storage device such as the IC card does not hold (store) the private key, there is a problem that the signature information can not be created. In this case, although it is also conceivable to adopt a method in which the data storage device holds the private key, as described above, since the private key can create the signature information, it has the same effect as certificate of a seal impression, and there is a problem that the damage is too high when the data storage device is lost and is used for an evil purpose.
Besides, if the electronic commercial transactions are carried out through the network by using only the common key encryption system adopted by the data storage device as described above, since a lot of opposite partner server devices or the like of the transactions have the common key, there is also a problem that such a probability becomes high that the common key is stolen or is used for an evil purpose.
In the present electronic settlement system, SSL (Secure Socket Layer) or SET (Secure Electronic Transaction) is often adopted. However, in the SSL, although safety to a communication path between a client device and a store device is assured, there is a problem that a dishonesty at the store side cannot be detected.
Although the SET has both the merit of the SSL and merit that falsifying can not be made by the client device, the store device, and the settlement management device, since the respective devices must have certificates of the PKI, there are problems that it is troublesome and expensive. Further, signature and signature check must be performed many times and it is redundant.
Moreover, the current electronic commercial transaction system does not include confirmation as to whether value information confirmed by the user on the client device is identical to value information actually written in the data storage device such as the IC card.